[PATCH] site: SECURITY: Properly update full peer address array
Ian Jackson
ijackson at chiark.greenend.org.uk
Thu May 15 02:04:46 BST 2014
If we already have the maximum number of peer addresses, do not
stuff the peer address into the wrong slot.
If a site instance is configured with the maximum permissible limit on
the number of mobile peer addresses (ie with mobile-peers-max set to
5), this overruns the transport peers array. In such a configuration
this is a security problem. It looks like a denial of service and
privilege escalation can't be ruled out. Configurations without
mobile peers are not affected.
Otherwise it simply means the address is ignored.
Signed-off-by: Ian Jackson <ijackson at chiark.greenend.org.uk>
---
site.c | 2 +-
1 file changed, 1 insertion(+), 1 deletion(-)
diff --git a/site.c b/site.c
index f87328f..f0a2922 100644
--- a/site.c
+++ b/site.c
@@ -1955,7 +1955,7 @@ static void transport_record_peer(struct site *st, transport_peers *peers,
changed=1;
if (peers->npeers==st->transport_peers_max)
- slot=st->transport_peers_max;
+ slot=st->transport_peers_max-1;
else
slot=peers->npeers++;
--
1.7.10.4
More information about the sgo-software-discuss
mailing list